Risks=Threats x Vulnerabilities is referred to as the:

A Business Impact Analysis (BIA) identifies the effects of disruptions on business functions and determines recovery priorities, not the mathematical relationship between threats and vulnerabilities.

A disaster recovery formula relates to restoring systems after an incident; it does not define the relationship between threats and vulnerabilities.

The risk equation expresses that risk is a product of the likelihood of a threat exploiting a vulnerability. This formula is a core concept in risk management frameworks such as NIST SP 800-30 and helps organizations prioritize controls by understanding which threat-vulnerability combinations produce the greatest risk.

A threat assessment evaluates the likelihood and nature of specific threats but does not encompass the full risk equation that incorporates vulnerabilities.